A validator that trusts its own node has stopped watching the network. The watch begins where the single view ends.
A single full node answers one question well: what does this machine believe the head of the chain is. It answers a second question badly, and the second question is the one an operator actually needs. Is what this machine believes the same as what the network agreed. A node that has been partitioned, fed a stale peer set, or served a minority fork will report a height and a block hash with complete confidence. The confidence is the danger. It reads as health when it is the opposite of health.
On 2026-07-04 the arc reached the recovery end of this problem: a chain that had already halted, exported its state, and rehearsed a relaunch. Recovery is expensive and coordinated and slow. Everything upstream of it is cheaper. The height-divergence watch is the cheapest of all, and it is the difference between an operator who learns of a fork from a monitoring signal and an operator who learns of it from an angry delegator.
Today names the detection layer. Three signals carry it: the height-divergence watch that compares many nodes against each other rather than trusting one, the equivocation alert that catches a validator signing two different blocks at one height, and the halt-decision signal that tells a human operator the moment the safe move is to stop rather than to keep producing.
Start with what a proof-of-stake network guarantees and what it does not. Petrov's treatment of Byzantine fault tolerance in Database Internals (Part II, pp. 330–331) sets the ceiling plainly: a BFT protocol keeps agreement as long as faulty participants stay under a threshold, classically less than one third of voting power. Cross that threshold and the protocol has no promise left to keep. Two honest nodes can finalize two different blocks at the same height, and neither is lying.
This is why the monitoring cannot live inside consensus. Consensus is the thing being watched. The watch has to sit outside it, at the operations layer, reading the same public surface every node exposes and comparing the readings. A validator that grades its own liveness from its own logs has built a mirror, not a monitor. The 2026-06-20 liveness lesson made this point at the single-validator scale (missed-block alerting reads the chain's record of you, not your record of yourself). Fork detection makes the same move at network scale.
A lagging node and a forked node both report a height below the network. The difference matters completely. A lagging node is behind on the same history and will catch up. A forked node is on a different history and will never catch up, because it is building on a block the rest of the network rejected. Height alone cannot tell them apart. Height plus block hash at a shared height can. If two nodes report the same height and different hashes, that is not lag. That is a split.
The height-divergence watch polls a set of independent nodes and builds a small table: for each node, its reported height and the block hash it holds at a chosen recent height below the tip. Below the tip, because the tip itself is legitimately in flux for a block or two as consensus settles. A few blocks back, every honest node on the same chain must agree exactly. Disagreement there is the signal.
The reducer over that table is the quorum-of-heads. Group the nodes by the block hash they report at the reference height. Sum the weight behind each hash. If one hash holds a supermajority of the polled weight and the rest hold nothing, the chain is healthy and the watch is quiet. If the weight splits across two hashes, the watch has found a fork, and the size of the minority group tells the operator how bad it is.
Three shapes come out of the reducer, and each earns a different response:
Every polled node reports one hash at the reference height. The chain is single-headed. No action. The watch records the agreement and sleeps until the next poll.
One or two nodes trail the majority head but sit on the same history one step back. This is lag, not fork. Page nobody; open a low-priority ticket if the lag persists past a threshold of blocks.
Two hashes each hold real weight at the reference height. This is a fork. Fire the halt-decision signal to a human immediately; the automated layer does not choose to halt, it chooses to wake someone who can.
Equivocation is the sharper cousin of the split. A node that watches signed votes can catch a single validator signing two different blocks at the same height and round. That is not ambiguity. That is a provable fault, the exact behavior slashing exists to punish, and the exact behavior that produces a fork when enough weight does it. An equivocation alert carries a higher severity than a height split because it names a culprit and carries cryptographic proof, where a height split only shows the symptom.
The SRE discipline (Beyer et al., Part III, pp. 330–331) sets the rule the halt-decision signal must obey: alert on the symptom the operator can act on, not on every internal cause. The operator cannot un-fork the chain by hand. The operator can stop their own validator from signing on the wrong head, can coordinate with peers, and can trigger the 07-04 recovery runbook. So the signal is scoped to exactly that decision. Not a wall of node-level noise. One page that says: the network has two heads, your validator is on this one, decide.
Take a Cosmos-style validator running three sentry full nodes plus two public RPC endpoints from independent providers, five vantage points in all. The watch polls each every few seconds for its latest height and for the block hash at height (tip minus five). Weight the two public endpoints lower than the operator's own sentries, because they are shared infrastructure of unknown health.
Steady state: all five report height 4,182,910-ish, and all five report the same hash A at reference height 4,182,905. The quorum-of-heads is unanimous on A. The watch emits a single green heartbeat and moves on. Grafana shows one line, not five, because the reducer has already collapsed the agreement into one fact.
Now a network partition cuts one sentry and one public endpoint onto a minority fork. They report hash B at 4,182,905 while the three-machine majority reports A. The quorum-of-heads now shows two groups: A with the operator's two remaining sentries and the majority weight, B with the isolated pair. The reducer flags split-heads. The halt-decision signal pages the on-call operator with the specific fact that the operator's own signing node is currently on head A, the majority head, and names the two vantage points that diverged.
The operator reads one page, confirms their signer sits on the majority head, and does not halt. The two divergent nodes are restarted with a corrected peer set and re-sync onto A. No recovery runbook was needed, because the fork was caught while it was still a partition and not yet a finalized double-history. Had the operator's signer been the one on the minority head, the same page would have told them so, and the decision flips: stop signing before the minority head finalizes anything and drags the validator into a slashable double-sign.
The 2026-06-09 RPC and full-node lesson built the vantage points this watch reads. Those endpoints existed to serve queries; the same endpoints, polled and compared, become a fork detector at no new infrastructure cost. The 2026-06-20 liveness lesson watched a single validator's own uptime against the chain's record. Today widens the lens from one validator's participation to the whole network's agreement, using the same principle: never grade yourself from your own logs. And 2026-07-04 sits directly downstream. The halt-decision signal is the trigger that starts the coordinated genesis restart. Detection and recovery are two ends of one runbook, and this lesson is the end that fires first.
The quorum-of-heads reducer is an algorithm before it is any language's code. Today's Python lesson writes it. It takes the poll results, groups the nodes by reported head, tallies the weight behind each head with collections.Counter, and returns the majority head plus a divergence verdict. The Ops concept and the Dev implementation are the same idea at two resolutions: here, the operational meaning of comparing many views against each other; there, the exact data structure that does the comparison and the quorum threshold that reads the tally. Read them as one lesson in two registers.
A validator earns its stake by signing the right head. Everything in this lesson serves that one act. The height-divergence watch reads many nodes so no single node can lie by omission. The equivocation alert catches the provable fault with its proof attached. The halt-decision signal turns all of that into one clear page for the one human who can act. Build the watch outside consensus, weight your own sentries above shared infrastructure, and reference a height a few blocks back from the tip where honest nodes must agree exactly. Then let the reducer stay quiet until the day it has something worth waking you for.
Examine the watch you would build for your own signer. If it reads one node, it is a mirror. Give it a quorum, and it becomes a monitor.